Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 9,759 published records · 23 KEV · 9,759 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

9,759 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit9269.5%
High3,57237%
Med2,95330%
Low3183.3%
None120.12%
Legacy00.00%
Unscored1,97820%

Matching records by UTC month

Jul 269,759

Signal coverage

KEV-listed: 23
With a forecast: 9,759
Unknown date: 0
Unscored severity: 1,978

Share of cohort: KEV 0.24% · forecast 100% · unscored 20%.

Showing 101–120 of 9,759By severity band: Critical · 9.0–10.0 926, High · 7.0–8.9 3,572, Medium · 4.0–6.9 2,953, Low · 0.1–3.9 318, None · scored 0.0 12, Legacy · v2 only 0, Unscored · no CNA metric 1,978

MedPublished 31 Jul 2026, 14:08 WIB

CVE-2026-18203

Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T07:08:26.588Z. Updated 2026-08-31T15:01:24.646Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:01 WIB

Official record

MedPublished 31 Jul 2026, 14:08 WIB

CVE-2026-18211

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 101 to 120 of 9759.First page Next page

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T07:08:24.767Z. Updated 2026-08-31T15:22:58.061Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:22 WIB

Official record

MedPublished 31 Jul 2026, 14:08 WIB

CVE-2026-18208

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempt…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T07:08:20.512Z. Updated 2026-08-31T15:01:28.494Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:01 WIB

Official record

MedPublished 31 Jul 2026, 14:03 WIB

CVE-2026-16105

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T07:03:36.107Z. Updated 2026-09-16T18:34:16.377Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated17 Sep 2026, 01:34 WIB

Official record

MedPublished 31 Jul 2026, 13:48 WIB

CVE-2026-18215

Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:48:14.687Z. Updated 2026-09-16T18:34:34.852Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated17 Sep 2026, 01:34 WIB

Official record

LowPublished 31 Jul 2026, 13:38 WIB

CVE-2026-18217

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that incl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:38:25.023Z. Updated 2026-07-31T19:32:22.166Z.

CVSS3.4v3.1KEVNot listedEPSSPresentUpdated01 Aug 2026, 02:32 WIB

Official record

MedPublished 31 Jul 2026, 13:38 WIB

CVE-2026-18218

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation poli…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:38:18.291Z. Updated 2026-09-16T18:34:36.111Z.

CVSS4.2v3.1KEVNot listedEPSSPresentUpdated17 Sep 2026, 01:34 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14919

ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

The ShopMonitor.io WordPress plugin before 1.2.0 does not properly restrict its email-rerouting test mode, gating it behind a trusted-source check that is satisfiable with client-supplied request headers, allowing unauthenticated attackers to redirect outgoing emails, including the WordPress administrator password-res…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:12.218Z. Updated 2026-07-31T16:38:27.612Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:38 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-14862

Support Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization

The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who obtain the stored attachment file name to download other users' private ticket attachments.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:12.039Z. Updated 2026-07-31T16:41:08.252Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:41 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-13609

Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:11.859Z. Updated 2026-07-31T16:44:13.155Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:44 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12697

wpForo Forum < 3.1.2 - Subscriber+ Cross-User AI Chat Message Deletion via IDOR

The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowing users with a subscriber-level account to permanently delete the stored AI chat message history of any other user.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:11.681Z. Updated 2026-07-31T16:47:17.952Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:47 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12695

miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

The miniOrange 2FA WordPress plugin before 6.2.6 does not validate the submitted one-time password against the targeted user's stored secret, instead verifying it against an attacker-supplied value, allowing an unauthenticated attacker who knows a victim's password to bypass two-factor authentication and gain access t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:11.504Z. Updated 2026-07-31T17:42:33.859Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:42 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12376

Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint

The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber-level access and above (enrolled in any single course) to read every user's quiz attempts across the whole site, including personal data such as IP addresses, n…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:11.328Z. Updated 2026-07-31T17:43:31.961Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:43 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-13393

ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered_html capability to save them, allowing users with administrative capabilities to store malicious…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:11.152Z. Updated 2026-07-31T17:45:29.200Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:45 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-13392

ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently executes, allowing arbi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:10.969Z. Updated 2026-07-31T16:49:52.762Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:49 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12721

Kirki < 6.0.13 - Unauthenticated SQL Injection

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:10.742Z. Updated 2026-07-31T16:52:19.507Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:52 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12720

Kirki < 6.0.13 - Unauthenticated PHP Object Injection

The Kirki WordPress plugin before 6.0.13 does not restrict which classes may be instantiated when it deserialises data that unauthenticated users can store, leading to PHP Object Injection that is triggered when an administrator later reviews the stored data. With a suitable gadget chain present on the site (via anoth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:10.525Z. Updated 2026-07-31T16:53:55.130Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:53 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-12251

Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role tha…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:10.354Z. Updated 2026-07-31T16:55:03.841Z.

CVSS—KEVNot listedEPSSPresentUpdated31 Jul 2026, 23:55 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-8155

BuddyPress < 14.5.0 - Subscriber+ Private Messages Disclosure via IDOR

The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subscriber+) to read, modify, or delete other users' private messages.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:10.175Z. Updated 2026-07-31T17:46:16.024Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:46 WIB

Official record

UnscoredPublished 31 Jul 2026, 13:00 WIB

CVE-2026-15381

WP Go Maps < 10.1.04 - Unauthenticated SQL Injection via Markers REST filter

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-07-31T06:00:09.998Z. Updated 2026-07-31T17:47:20.807Z.

CVSS—KEVNot listedEPSSPresentUpdated01 Aug 2026, 00:47 WIB

Official record