Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 1001–1020 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

HighPublished 28 Oct 2026, 09:29 WIB

CVE-2026-111314

affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atkp_product_producturl' parameter in all versions up to, and including, 3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:59.059Z. Updated 2026-10-29T01:51:59.496Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:51 WIB

Official record

HighPublished 28 Oct 2026, 09:29 WIB

CVE-2026-97019

AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1001 to 1020 of 16156.First page Next page

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:58.709Z. Updated 2026-10-29T01:51:59.638Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:51 WIB

Official record

HighPublished 28 Oct 2026, 09:29 WIB

CVE-2026-109999

AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:58.364Z. Updated 2026-10-28T16:11:01.240Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:11 WIB

Official record

MedPublished 28 Oct 2026, 09:29 WIB

CVE-2026-109974

All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more_link' parameter in all versions up to, and including, 4.9.7 due to insufficient input sanitization and output escaping. This makes it possible f…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:57.994Z. Updated 2026-10-29T01:51:59.778Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:51 WIB

Official record

CritPublished 28 Oct 2026, 09:29 WIB

CVE-2026-84999

Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

The Pie Register Premium plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 3.8.4.0 via the piereg_file_upload function. This is due to the plugin performing file type validation via wp_check_filetype and wp_check_filetype_and_ext but never checking whether those v…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:57.638Z. Updated 2026-10-29T01:51:59.919Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 08:51 WIB

Official record

MedPublished 28 Oct 2026, 09:29 WIB

CVE-2026-107625

Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:29:57.142Z. Updated 2026-10-28T16:11:08.360Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:11 WIB

Official record

MedPublished 28 Oct 2026, 09:21 WIB

CVE-2026-115624

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:21:49.154Z. Updated 2026-10-28T02:21:49.154Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:21 WIB

Official record

LowPublished 28 Oct 2026, 09:21 WIB

CVE-2026-109848

CVE-2026-109848

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:21:37.093Z. Updated 2026-10-28T02:21:37.093Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:21 WIB

Official record

LowPublished 28 Oct 2026, 09:21 WIB

CVE-2026-105272

CVE-2026-105272

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

Excerpt language: en.

Severity low: primary CNA CVSS 2.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:21:24.458Z. Updated 2026-10-28T02:21:24.458Z.

CVSS2.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:21 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118378

Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted table_name to the describe_table tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument and append statements…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:24.996Z. Updated 2026-10-28T02:03:24.996Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118377

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, am…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:24.283Z. Updated 2026-10-28T02:03:24.283Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118376

WeKnora before 0.8.2 SSRF Guard Bypass via NAT64 IPv6 Addresses

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via web_fetch or URL-based knowledge import to reach internal services or c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:23.589Z. Updated 2026-10-28T16:11:20.194Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:11 WIB

Official record

CritPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118375

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:22.895Z. Updated 2026-10-28T02:03:22.895Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to http_head_read() and http_bo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:22.183Z. Updated 2026-10-28T02:03:22.183Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118373

LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:21.525Z. Updated 2026-10-28T02:03:21.525Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 CRLF Injection via AIA OCSP URL Path

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host() copies the path without rejecting control characters and http_open() places it in the POST request line, attackers c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:20.849Z. Updated 2026-10-28T16:11:41.029Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:11 WIB

Official record

MedPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118371

LibreSSL through 4.4.0 CRLF Injection via OCSP_sendreq_new() Request Line

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information Access OCSP URI …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:20.152Z. Updated 2026-10-28T02:03:20.152Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-118370

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:19.447Z. Updated 2026-10-28T02:03:19.447Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117610

libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:18.766Z. Updated 2026-10-28T02:03:18.766Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 09:03 WIB

Official record

HighPublished 28 Oct 2026, 09:03 WIB

CVE-2026-117609

rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to crash rtl_433 and co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-28T02:03:18.083Z. Updated 2026-10-28T16:12:02.323Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated28 Oct 2026, 23:12 WIB

Official record