Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1281–1300 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 27 Aug 2026, 18:30 WIB

CVE-2026-81562

AlexGladkov claude-in-mobile client.ts execSync os command injection

A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgradin…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T11:30:13.109Z. Updated 2026-08-27T14:48:35.634Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:48 WIB

Official record

MedPublished 27 Aug 2026, 18:15 WIB

CVE-2026-81668

Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup

A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in anoth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1281 to 1300 of 12259.First page Next page

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T11:15:42.330Z. Updated 2026-10-14T16:08:30.161Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated14 Oct 2026, 23:08 WIB

Official record

MedPublished 27 Aug 2026, 18:12 WIB

CVE-2026-5218

HTML Injection in Softtr's E-Commerce Pack

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T11:12:03.773Z. Updated 2026-08-27T15:04:10.478Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:04 WIB

Official record

MedPublished 27 Aug 2026, 17:47 WIB

CVE-2026-17562

IDOR in Zirve Security's AdisyonPro

Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:47:24.278Z. Updated 2026-08-27T15:04:10.649Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:04 WIB

Official record

CritPublished 27 Aug 2026, 17:40 WIB

CVE-2026-74233

Zbtlink MQWrt infosrvd Command Injection

Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated co…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:40:11.313Z. Updated 2026-08-27T13:41:32.924Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 20:41 WIB

Official record

CritPublished 27 Aug 2026, 17:39 WIB

CVE-2026-74232

Zbtlink MQWrt yunmgrd Cloud C2 Implant

Zbtlink L3_V2_8 firmware 3.0.0.4.528, Zbtlink WE826-T2 firmware 19.1101, Zbtlink ZBT-7628 firmware 1.0.0.2.007, Zbtlink ZBT-ZBT7621 firmware 1.0.0.3.001, MoreQuick MQAC-7620, MQAC-7620A, MQAP-7620, MQAP-7620A, and MQAP-7628 firmware 1.0.0.2.000, AP522 firmware 1.0.0.2.014, AP7628 and HC5661A firmware 3.0.0.4.380, APG72…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:39:14.386Z. Updated 2026-08-27T14:49:10.575Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:49 WIB

Official record

MedPublished 27 Aug 2026, 17:30 WIB

CVE-2026-81560

blackms aistack Static File server.ts path traversal

A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The attack can be executed remotely. The exploit is publicly availabl…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:30:11.125Z. Updated 2026-08-29T02:56:31.506Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 09:56 WIB

Official record

HighPublished 27 Aug 2026, 17:23 WIB

CVE-2026-81662

Flowintel Alert Settings Configuration Allows Remote Code Execution via Arbitrary Configuration Keys

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requeste…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:23:01.833Z. Updated 2026-08-27T15:53:21.261Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:53 WIB

Official record

MedPublished 27 Aug 2026, 17:22 WIB

CVE-2026-81658

Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup

A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain historical template contents belonging to another organization …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:22:08.586Z. Updated 2026-08-27T14:47:55.250Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:47 WIB

Official record

HighPublished 27 Aug 2026, 17:07 WIB

CVE-2026-81659

Flowintel Note PDF Export Allows Arbitrary Local File Read via Pandoc/XeLaTeX Processing

Affected versions of Flowintel allow attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export in a way that can cause local files on the Flowintel server to be read and incorporated into the generated export.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T10:07:30.269Z. Updated 2026-08-27T15:56:07.807Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:56 WIB

Official record

HighPublished 27 Aug 2026, 16:16 WIB

CVE-2026-74848

Apache APISIX: Cross-user response poisoning in serverless plugins

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache APISIX. An attacker could make other clients receive attacker-chosen or other users' responses on serverless-plugin routes. This issue affects Apache APISIX: from 2.12.0 through 3.17.0. Users are recommended…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:16:06.985Z. Updated 2026-08-27T12:05:30.790Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:05 WIB

Official record

HighPublished 27 Aug 2026, 16:15 WIB

CVE-2026-75005

Apache APISIX: Unauthenticated CPU-exhaustion DoS

Inefficient Algorithmic Complexity vulnerability in Apache APISIX. A single small request can pin a gateway worker at 100% CPU for an extended period in graphql-limit-count routes. This issue affects Apache APISIX: 3.17.0. Users are recommended to upgrade to version 3.18.0, which fixes the issue.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:15:32.196Z. Updated 2026-08-27T12:06:27.060Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:06 WIB

Official record

HighPublished 27 Aug 2026, 16:14 WIB

CVE-2026-75020

Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache APISIX. A caller who holds valid credentials for one entry in the LDAP directory can authenticate through APISIX as a consumer mapped to a different entry, one the plugin's configured scope was meant to keep ou…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:14:33.099Z. Updated 2026-08-27T12:09:54.558Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:09 WIB

Official record

HighPublished 27 Aug 2026, 16:06 WIB

CVE-2026-81625

Stack buffer overflow in Greenbone OS and openvas-scanner

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.

Excerpt language: en.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:06:44.122Z. Updated 2026-08-27T12:12:02.884Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:12 WIB

Official record

HighPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81277

WordPress Suggestion Engine for WooCommerce plugin <= 2.0.11 - SQL Injection vulnerability

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:10.584Z. Updated 2026-08-27T14:31:08.991Z.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:31 WIB

Official record

MedPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81276

WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:09.884Z. Updated 2026-08-28T18:35:56.466Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Aug 2026, 01:35 WIB

Official record

MedPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81274

WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability

Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:09.177Z. Updated 2026-08-27T12:31:07.802Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:31 WIB

Official record

HighPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81273

WordPress FluentBooking Pro plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in FluentBooking Pro <= 2.2.4 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:08.436Z. Updated 2026-08-27T15:00:53.378Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:00 WIB

Official record

MedPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81272

WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability

Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:07.759Z. Updated 2026-08-27T12:16:35.326Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 19:16 WIB

Official record

HighPublished 27 Aug 2026, 16:00 WIB

CVE-2026-81271

WordPress GeoDirectory plugin <= 2.8.176 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in GeoDirectory <= 2.8.176 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T09:00:07.037Z. Updated 2026-08-27T14:31:22.769Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:31 WIB

Official record