Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2521–2540 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 25 Aug 2026, 14:39 WIB

CVE-2026-18323

Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauth…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T07:39:50.038Z. Updated 2026-08-25T14:51:54.599Z.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 21:51 WIB

Official record

HighPublished 25 Aug 2026, 14:39 WIB

CVE-2026-16601

CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Action

The CM Map Locations – Visualize and share your locations in a few clicks plugin for WordPress is vulnerable to Limited Arbitrary File Upload in all versions up to, and including, 2.1.8 via the uploadMedia function. This is due to insufficient file type validation in the upload handler, which performs incomplete extens…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2521 to 2540 of 12259.First page Next page

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T07:39:49.527Z. Updated 2026-08-27T15:01:02.198Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 22:01 WIB

Official record

MedPublished 25 Aug 2026, 14:33 WIB

CVE-2026-78701

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T07:33:02.549Z. Updated 2026-10-08T23:22:15.672Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated09 Oct 2026, 06:22 WIB

Official record

MedPublished 25 Aug 2026, 14:21 WIB

CVE-2026-78322

File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlers

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer overflow and cause file-roll…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T07:21:38.573Z. Updated 2026-08-27T14:59:54.395Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:59 WIB

Official record

MedPublished 25 Aug 2026, 13:27 WIB

CVE-2026-68959

CVE-2026-68959

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:27:59.698Z. Updated 2026-08-25T19:52:07.568Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:52 WIB

Official record

MedPublished 25 Aug 2026, 13:27 WIB

CVE-2026-68062

CVE-2026-68062

SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected products installed and can …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:27:54.700Z. Updated 2026-08-25T15:07:18.811Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:07 WIB

Official record

HighPublished 25 Aug 2026, 13:27 WIB

CVE-2026-66109

CVE-2026-66109

A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:27:50.328Z. Updated 2026-08-25T19:02:20.730Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:02 WIB

Official record

MedPublished 25 Aug 2026, 13:27 WIB

CVE-2026-68960

CVE-2026-68960

A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may be able to execute arbitrary code on another Windows system that has the affected product inst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:27:20.798Z. Updated 2026-08-25T15:07:50.519Z.

CVSS5.8v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:07 WIB

Official record

HighPublished 25 Aug 2026, 13:27 WIB

CVE-2026-69665

CVE-2026-69665

SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions. If this vulnerability is exploited, an attacker who can log in to a Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:27:10.352Z. Updated 2026-08-25T15:08:24.081Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:08 WIB

Official record

MedPublished 25 Aug 2026, 13:15 WIB

CVE-2026-78656

itsourcecode Sales and Inventory System cust_del.php sql injection

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/cust_del.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:15:09.674Z. Updated 2026-08-25T11:55:24.465Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 18:55 WIB

Official record

MedPublished 25 Aug 2026, 13:00 WIB

CVE-2026-78654

cleverbrush framework/deep deepExtend.ts deepExtend prototype pollution

A vulnerability has been found in cleverbrush framework and deep up to 4.4.0. This impacts the function deepExtend of the file libs/deep/src/deepExtend.ts. The manipulation leads to improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The exploit has been dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T06:00:13.406Z. Updated 2026-08-25T13:17:33.100Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 20:17 WIB

Official record

MedPublished 25 Aug 2026, 12:31 WIB

CVE-2026-78470

WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T05:31:28.953Z. Updated 2026-08-25T15:09:07.908Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:09 WIB

Official record

HighPublished 25 Aug 2026, 12:31 WIB

CVE-2026-78478

Måne <= 1.7 - Unauthenticated Local File Inclusion

The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T05:31:28.313Z. Updated 2026-08-25T12:02:00.193Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 19:02 WIB

Official record

MedPublished 25 Aug 2026, 12:30 WIB

CVE-2026-78638

peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The exploit has been published…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T05:30:08.899Z. Updated 2026-08-27T14:36:08.272Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:36 WIB

Official record

MedPublished 25 Aug 2026, 11:45 WIB

CVE-2026-78637

Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

A vulnerability was detected in Fdawgs node-poppler up to 9.1.2/10.0.1. The impacted element is the function pdfInfo/pdfToText/pdfToCairo/pdfToPpm/pdfImages/pdfToHtml/pdfToPs/pdfFonts/pdfDetach/pdfAttach/pdfSeparate/pdfUnite of the file src/index.js of the component Argument Injection Handler. Performing a manipulation…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T04:45:11.359Z. Updated 2026-08-25T15:13:59.379Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:13 WIB

Official record

MedPublished 25 Aug 2026, 11:37 WIB

CVE-2026-13215

Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem image

The Zephyr ext2 filesystem driver fails to validate the s_log_block_size field of the on-disk superblock when mounting a filesystem. ext2_verify_disk_superblock() in subsys/fs/ext2/ext2_impl.c checks the magic number, revision, inode size and group counts, but never bounds s_log_block_size. On a successful verify, subs…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T04:37:21.765Z. Updated 2026-08-25T15:15:11.838Z.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:15 WIB

Official record

CritPublished 25 Aug 2026, 11:37 WIB

CVE-2026-13214

Stack buffer overflow in OCPP GetConfiguration key parsing

The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp_j.c contains a stack buffer overflow in parse_getconfig_msg(). When handling a GetConfiguration request from the central system, the handler copied the attacker-controlled JSON "key" string into the caller's fixed 50-byte stack buffer (skey[CISTR50], declared in subsys/ne…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T04:37:20.629Z. Updated 2026-08-25T15:15:52.330Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:15 WIB

Official record

MedPublished 25 Aug 2026, 11:27 WIB

CVE-2026-12561

tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc_raw_html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc_raw_html::render() method, which base64-decodes shortcode content (after a strip_tag…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T04:27:01.129Z. Updated 2026-08-25T12:06:05.846Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated25 Aug 2026, 19:06 WIB

Official record

MedPublished 25 Aug 2026, 10:27 WIB

CVE-2026-19943

Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T03:27:07.375Z. Updated 2026-08-25T18:12:00.782Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 01:12 WIB

Official record

MedPublished 25 Aug 2026, 10:27 WIB

CVE-2026-14280

Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the em_options_save function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute arb…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T03:27:07.025Z. Updated 2026-08-25T19:22:20.406Z.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated26 Aug 2026, 02:22 WIB

Official record