Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 121–140 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 31 Aug 2026, 22:26 WIB

CVE-2026-77975

Ebyte NA111-M Cleartext Storage of Sensitive Information

The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who can obtain an exported configuration file could recover valid credentials and use them to access the device or similarly …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:26:08.482Z. Updated 2026-10-05T19:27:44.696Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated06 Oct 2026, 02:27 WIB

Official record

HighPublished 31 Aug 2026, 22:23 WIB

CVE-2026-75133

Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed `kbd_cron_process` parameter without authentication. Attackers can predict the partially predictable d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 121 to 140 of 12259.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:23:05.155Z. Updated 2026-10-01T15:21:07.796Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:21 WIB

Official record

MedPublished 31 Aug 2026, 22:15 WIB

CVE-2026-82802

NASA earthdata-search granules Endpoint handler.js OpenSearchGranuleSearchLambda server-side request forgery

A flaw has been found in NASA earthdata-search 1.0.0. Affected by this issue is the function OpenSearchGranuleSearchLambda of the file serverless/src/openSearchGranuleSearch/handler.js of the component granules Endpoint. Executing a manipulation of the argument openSearchOsdd can lead to server-side request forgery. Th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:15:08.884Z. Updated 2026-08-31T15:38:13.824Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:38 WIB

Official record

HighPublished 31 Aug 2026, 22:01 WIB

CVE-2026-75132

WAPT Server SQL Injection via /api/v3/hosts Endpoint

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the `columns` parameter of the GET `/api/v3/hosts` endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting the injection point,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:01:47.867Z. Updated 2026-10-01T19:19:27.886Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated02 Oct 2026, 02:19 WIB

Official record

MedPublished 31 Aug 2026, 22:00 WIB

CVE-2026-82801

NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery

A vulnerability was detected in NASA earthdata-search 1.0.0. Affected by this vulnerability is the function scaleImage of the file serverless/src/scaleImage/handler.js of the component scale Endpoint. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T15:00:09.919Z. Updated 2026-08-31T17:56:25.791Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 00:56 WIB

Official record

CritPublished 31 Aug 2026, 21:46 WIB

CVE-2026-66047

ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Installation RCE

ProfilePress (wp-user-avatar) WordPress plugin before 4.17.2 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to install and activate arbitrary plugins by brute-forcing a weak 32-bit connect token via the ppress_connect_process AJAX handler. Attackers can supply a ca…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:46:41.174Z. Updated 2026-10-01T15:20:16.267Z.

CVSS9.2v4.0KEVNot listedEPSSPresentUpdated01 Oct 2026, 22:20 WIB

Official record

MedPublished 31 Aug 2026, 21:45 WIB

CVE-2026-82703

Edimax BR-6214K asp_setPing Endpoint ping.asp system os command injection

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp_setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The exploit has been releas…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:45:09.220Z. Updated 2026-08-31T21:58:04.333Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 04:58 WIB

Official record

CritPublished 31 Aug 2026, 21:43 WIB

CVE-2026-82970

WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent allows Using Malicious Files. This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through 4.4.1.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:43:38.358Z. Updated 2026-08-31T18:51:27.733Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 01:51 WIB

Official record

CritPublished 31 Aug 2026, 21:43 WIB

CVE-2026-59111

Command Injection vulnerability in eObčanka-Identifikace

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Digitální a informační agentura (DIA) eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme (czeeopauth://) for parameterized application execution. Prior to version 3.6.0, incoming U…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:43:02.777Z. Updated 2026-08-31T15:53:35.691Z.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 22:53 WIB

Official record

MedPublished 31 Aug 2026, 21:30 WIB

CVE-2026-82702

Edimax BR-6214K asp_WlanMP Endpoint wlanMP.asp system os command injection

A vulnerability was identified in Edimax BR-6214K 1.40. This affects the function system of the file www/wlanMP.asp of the component asp_WlanMP Endpoint. Such manipulation of the argument ateFunc leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:30:07.775Z. Updated 2026-08-31T14:44:39.188Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:44 WIB

Official record

MedPublished 31 Aug 2026, 21:15 WIB

CVE-2026-82701

code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack remotely. The exploit has …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:15:08.247Z. Updated 2026-09-02T13:56:49.515Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated02 Sep 2026, 20:56 WIB

Official record

HighPublished 31 Aug 2026, 21:14 WIB

CVE-2026-78422

zbus_polkit: polkit authorization bypass via PID reuse due to incorrect D-Bus type for the subject UID

Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-Bus type u), whereas the org.freedesktop.PolicyKit1.Authority interface specifies a signed 32-bit integer (D-Bus type i). Because of this type mismatch, polkit silently discards the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:14:13.558Z. Updated 2026-09-01T14:46:42.303Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:46 WIB

Official record

MedPublished 31 Aug 2026, 21:00 WIB

CVE-2026-82700

code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting

A vulnerability was found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /offersmail.php of the component Newsletter Subscription. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exp…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T14:00:11.324Z. Updated 2026-08-31T14:21:34.727Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:21 WIB

Official record

MedPublished 31 Aug 2026, 20:59 WIB

CVE-2026-78075

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whether the user was authorized to edit the article ID passed in the request, but did not verify whether the specified image path (src) belonged to that article. On Jo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:59:08.717Z. Updated 2026-09-01T14:06:08.584Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:06 WIB

Official record

MedPublished 31 Aug 2026, 20:58 WIB

CVE-2026-78076

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate < 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions (core.edit on com_menus.item.{id} or core.admin). An authenticated user could submit m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:58:50.141Z. Updated 2026-09-01T14:05:49.323Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:05 WIB

Official record

HighPublished 31 Aug 2026, 20:55 WIB

CVE-2026-78078

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10 - Image uploads previously validated only file extension and basic size parameters. Non-image files disguised with raster extensions could be uploaded. Added strict MIME verification and GD binary raster de…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:55:28.264Z. Updated 2026-09-01T14:02:20.983Z.

CVSS8.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:02 WIB

Official record

HighPublished 31 Aug 2026, 20:54 WIB

CVE-2026-19702

OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.

Excerpt language: en.

Severity high: primary CNA CVSS 7.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:54:45.791Z. Updated 2026-08-31T14:25:48.846Z.

CVSS7.8v3.1KEVNot listedEPSSPresentUpdated31 Aug 2026, 21:25 WIB

Official record

HighPublished 31 Aug 2026, 20:54 WIB

CVE-2026-76763

Io.smallrye/smallrye-graphql: smallrye graphql: unauthenticated denial of service via large exponent float literals

A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:54:18.490Z. Updated 2026-10-20T04:32:14.834Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated20 Oct 2026, 11:32 WIB

Official record

HighPublished 31 Aug 2026, 20:53 WIB

CVE-2026-78077

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.10 - Unsanitized column and item configuration values stored within the MegaMenu layout JSON were rendered without complete contextual escaping, allowing injection of malicious HTML…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:53:43.475Z. Updated 2026-09-01T14:00:33.673Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:00 WIB

Official record

MedPublished 31 Aug 2026, 20:52 WIB

CVE-2026-78079

Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate < 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T13:52:47.148Z. Updated 2026-09-01T13:59:40.324Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:59 WIB

Official record