Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2521–2540 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 25 Oct 2026, 18:51 WIB

CVE-2026-116137

adm-zip through 0.6.1 Duplicate-Entry Validation Bypass via Canonically Equivalent Names

adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates benign content while extractAllTo() writes…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:51:01.980Z. Updated 2026-10-25T11:51:01.980Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:51 WIB

Official record

MedPublished 25 Oct 2026, 18:51 WIB

CVE-2026-116136

ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking

ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope clients, causing moveAssignmentsToRoot() to…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2521 to 2540 of 16156.First page Next page

Severity medium: primary CNA CVSS 6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:51:01.317Z. Updated 2026-10-25T11:51:01.317Z.

CVSS6v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:51 WIB

Official record

MedPublished 25 Oct 2026, 18:51 WIB

CVE-2026-116073

Leon before commit 50df142 Path Traversal via /download model Command

Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containing encoded '../' sequences to write attac…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:51:00.624Z. Updated 2026-10-25T11:51:00.624Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:51 WIB

Official record

MedPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116072

Infinity for Reddit through 8.3.4 OAuth Login CSRF via LoginChromeCustomTabActivity

Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers can authorize the app's client ID with t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:59.942Z. Updated 2026-10-26T16:53:14.770Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:53 WIB

Official record

HighPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116071

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:59.252Z. Updated 2026-10-29T15:56:14.804Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:56 WIB

Official record

MedPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116070

Docker-Proxy through 5.1.9 Missing Authentication via hubcmdui /api/config

Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwrite menuItems links, proxyDomain, and the…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:58.565Z. Updated 2026-10-25T11:50:58.565Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:50 WIB

Official record

MedPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116069

NiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field

NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private and link-local hosts to read loopback, int…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:57.876Z. Updated 2026-10-25T11:50:57.876Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:50 WIB

Official record

HighPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116068

Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment vari…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:57.177Z. Updated 2026-10-26T16:53:31.091Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:53 WIB

Official record

HighPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116067

Paisa before 0.7.8 Path Traversal via Editor and Sheet API

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:56.480Z. Updated 2026-10-29T15:53:06.012Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:53 WIB

Official record

HighPublished 25 Oct 2026, 18:50 WIB

CVE-2026-116066

Firecrawl before 2.11.586 SSRF Protection Bypass via DNS Rebinding in Playwright Service

Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation and a private address at connect time, …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T11:50:55.818Z. Updated 2026-10-25T11:50:55.818Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 18:50 WIB

Official record

MedPublished 25 Oct 2026, 15:45 WIB

CVE-2026-116050

krupalshah Employee Recruitment System Registration registerform3.php sql injection

A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injection. The attack can be initiated remotely.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T08:45:18.342Z. Updated 2026-10-25T08:45:18.342Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 15:45 WIB

Official record

MedPublished 25 Oct 2026, 15:30 WIB

CVE-2026-116049

krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql injection

A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument university/institute/branch/degree/status/…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T08:30:16.219Z. Updated 2026-10-26T17:36:48.995Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:36 WIB

Official record

MedPublished 25 Oct 2026, 15:00 WIB

CVE-2026-116048

krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection

A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gen…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T08:00:10.951Z. Updated 2026-10-29T15:41:40.858Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:41 WIB

Official record

MedPublished 25 Oct 2026, 14:30 WIB

CVE-2026-116047

Privoce Vocechat Query Parameter widget.html cross site scripting

A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T07:30:12.541Z. Updated 2026-10-25T07:30:12.541Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated25 Oct 2026, 14:30 WIB

Official record

MedPublished 25 Oct 2026, 13:45 WIB

CVE-2026-116046

eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal

A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes path traversal. It is possible to launc…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:45:08.260Z. Updated 2026-10-26T17:36:55.499Z.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated27 Oct 2026, 00:36 WIB

Official record

MedPublished 25 Oct 2026, 13:30 WIB

CVE-2026-116045

1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:30:12.208Z. Updated 2026-10-29T15:38:39.753Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 22:38 WIB

Official record

UnscoredPublished 25 Oct 2026, 13:00 WIB

CVE-2026-115251

Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click Upgrade

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to inst…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:00:22.211Z. Updated 2026-10-26T10:13:36.247Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record

UnscoredPublished 25 Oct 2026, 13:00 WIB

CVE-2026-115214

Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Role Headers

The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:00:22.035Z. Updated 2026-10-26T10:13:36.399Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record

UnscoredPublished 25 Oct 2026, 13:00 WIB

CVE-2026-115183

Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget

The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host, into posts where WordPress would other…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:00:21.850Z. Updated 2026-10-26T10:13:36.538Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record

UnscoredPublished 25 Oct 2026, 13:00 WIB

CVE-2026-114743

InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings

The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has granted access to the InstaWP Connect W…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-25T06:00:21.676Z. Updated 2026-10-26T10:13:36.679Z.

CVSS—KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record