Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 1341–1360 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-76549

UpdraftPlus < 1.26.7 - Backup Restoration via CSRF

The UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.7 does not have CSRF checks in one of its backup management actions, which could allow attackers to make a logged in admin restore an existing backup, reverting the site's database and files to an earlier state, via a crafted link.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:18.707Z. Updated 2026-08-27T14:23:47.167Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-19715

WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File

The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including pass…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 1341 to 1360 of 12259.First page Next page

Published 2026-08-27T06:00:18.109Z. Updated 2026-08-27T14:23:47.322Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-19454

JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data and the shared webroo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.928Z. Updated 2026-08-27T14:23:47.496Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-19225

Defender Security < 6.2.0 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.755Z. Updated 2026-08-27T14:23:47.663Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-19223

Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.560Z. Updated 2026-08-27T14:23:47.838Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-16569

ShopApper <= 0.4.62 - Subscriber+ Arbitrary Product Stock Update

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not check the user's capabilities before allowing a stock-update operation through one of its REST endpoints, allowing any authenticated user, such as a customer or subscriber, to change the stock q…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.387Z. Updated 2026-08-27T14:23:48.010Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-16568

ShopApper <= 0.4.62 - Subscriber+ Customer Data Disclosure via IDOR

The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.213Z. Updated 2026-08-27T14:23:48.190Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-16567

Document Embedder < 2.3.1 - Unauthenticated Private Document Download via Token Oracle

The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:17.044Z. Updated 2026-08-27T14:23:48.352Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-13416

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to inject arbitrary web scri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:16.861Z. Updated 2026-08-27T14:23:48.622Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-13415

CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings

The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary Word…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:16.668Z. Updated 2026-08-27T14:23:49.069Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

UnscoredPublished 27 Aug 2026, 13:00 WIB

CVE-2026-13414

CMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax

The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers to disable the site's maintenance/coming-soon mode under a non-default countdown c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T06:00:16.494Z. Updated 2026-08-27T14:23:49.236Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:23 WIB

Official record

CritPublished 27 Aug 2026, 12:50 WIB

CVE-2026-77991

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.4 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:50:13.521Z. Updated 2026-08-28T07:47:57.914Z.

CVSS9.4v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 14:47 WIB

Official record

MedPublished 27 Aug 2026, 12:48 WIB

CVE-2026-77034

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:48:02.596Z. Updated 2026-08-28T07:45:42.144Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 14:45 WIB

Official record

MedPublished 27 Aug 2026, 12:47 WIB

CVE-2026-77990

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read attendee names, usernames, registration dates and statuses for events they do not manage, including lists belonging to unpublished events.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:47:51.963Z. Updated 2026-08-28T07:45:30.323Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 14:45 WIB

Official record

MedPublished 27 Aug 2026, 12:46 WIB

CVE-2026-77035

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user with edit-own rights (the eventowner=1 setting or core.edit.own) can POST another user's record id together with their own id as created_by and take over that re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:46:06.829Z. Updated 2026-08-28T07:43:42.197Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 14:43 WIB

Official record

MedPublished 27 Aug 2026, 12:43 WIB

CVE-2026-77989

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1 - buildCurrentPdfLink copies the current request query string into the PDF button URL, and pdfbutton() echoes it unescaped, leading to an reflected XSS vector.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:43:56.550Z. Updated 2026-08-28T07:41:28.744Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated28 Aug 2026, 14:41 WIB

Official record

UnscoredPublished 27 Aug 2026, 12:21 WIB

CVE-2026-47893

Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService

A Spring WebFlux application that supports WebSocket connections may expose indirectly sensitive user information by including request headers in an exception reason. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:21:41.124Z. Updated 2026-08-28T19:12:43.970Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:12 WIB

Official record

UnscoredPublished 27 Aug 2026, 12:21 WIB

CVE-2026-47892

Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spri…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:21:40.168Z. Updated 2026-08-28T19:11:09.411Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Aug 2026, 02:11 WIB

Official record

UnscoredPublished 27 Aug 2026, 12:21 WIB

CVE-2026-47891

Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder

A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:21:39.288Z. Updated 2026-08-27T14:52:30.491Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:52 WIB

Official record

UnscoredPublished 27 Aug 2026, 12:21 WIB

CVE-2026-47890

Spring Framework Server Sent Event stream corruption while rendering fragments

Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE) with view fragments. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-27T05:21:38.260Z. Updated 2026-08-27T14:53:37.162Z.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:53 WIB

Official record