Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2481–2500 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 25 Aug 2026, 17:00 WIB

CVE-2026-16231

hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitutes the placeholder with…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T10:00:09.678Z. Updated 2026-08-25T19:47:42.474Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:47 WIB

Official record

UnscoredPublished 25 Aug 2026, 16:57 WIB

CVE-2026-49050

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2481 to 2500 of 12259.First page Next page

Published 2026-08-25T09:57:48.064Z. Updated 2026-08-25T14:40:07.589Z.

CVSS—KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:40 WIB

Official record

HighPublished 25 Aug 2026, 16:52 WIB

CVE-2026-75037

Polkit authentication bypass in LACT

Polkit Authentication Based on UnixProcessSubject / Peer PID in LACT on Linux allows an Authentication Bypass. This issue affects LACT through 0.10.0. Fixed by commit d0478fe42c2219454e272f96b1cbd29ab37ee566.

Excerpt language: en.

Severity high: primary CNA CVSS 7.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:52:32.993Z. Updated 2026-08-25T13:57:43.909Z.

CVSS7.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:57 WIB

Official record

MedPublished 25 Aug 2026, 16:27 WIB

CVE-2026-76128

eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:27:52.427Z. Updated 2026-08-25T11:31:27.695Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 18:31 WIB

Official record

HighPublished 25 Aug 2026, 16:02 WIB

CVE-2026-12878

CVE-2026-12878

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:02:15.246Z. Updated 2026-08-25T13:59:09.902Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:59 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-56092

Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:49.567Z. Updated 2026-09-17T05:52:44.702Z.

CVSS7.6v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 12:52 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-56093

Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsew…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:48.858Z. Updated 2026-09-17T05:53:29.682Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 12:53 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-56094

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read publ…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:48.087Z. Updated 2026-09-17T05:53:59.551Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 12:53 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-56095

Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 datab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:47.261Z. Updated 2026-09-17T05:55:44.089Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 12:55 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-56096

Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:46.440Z. Updated 2026-09-17T05:54:30.884Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 12:54 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77127

Information Disclosure in extension "Modules" (modules)

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the request…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:45.715Z. Updated 2026-09-16T17:43:29.770Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated17 Sep 2026, 00:43 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77128

Broken Access Control in extension "Event management and registration" (sf_event_mgt)

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverride…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:44.929Z. Updated 2026-08-25T14:06:14.408Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:06 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77129

Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)

The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitatio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:44.104Z. Updated 2026-08-25T14:07:46.294Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:07 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77130

Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:43.390Z. Updated 2026-08-25T14:51:54.258Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77131

Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:42.646Z. Updated 2026-08-25T14:51:54.415Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

MedPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77133

Broken Access Control in extension "femanager" (femanager)

The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:41.795Z. Updated 2026-08-25T14:51:54.568Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77134

Broken Access Control in extension "femanager" (femanager)

The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.

Excerpt language: en.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:40.986Z. Updated 2026-08-25T14:51:54.716Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77135

Information Disclosure in extension "femanager" (femanager)

The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.

Excerpt language: en.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:40.231Z. Updated 2026-08-25T14:51:54.880Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

CritPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77136

Server-Side Template Injection in extension "powermail" (powermail)

The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:39.526Z. Updated 2026-08-25T14:07:07.220Z.

CVSS9.5v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:07 WIB

Official record

HighPublished 25 Aug 2026, 16:00 WIB

CVE-2026-77137

SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T09:00:38.789Z. Updated 2026-08-25T14:06:42.472Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:06 WIB

Official record