Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 2561–2580 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

MedPublished 25 Aug 2026, 08:30 WIB

CVE-2026-75575

Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor Method

Rocket.Chat exposes the sendForgotPasswordEmail Meteor method without a DDP rate limit, so an unauthenticated caller may invoke it as often as it likes. The method is reachable over DDP and over the HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, and it triggers a password reset message for any address…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:29.898Z. Updated 2026-08-29T11:47:47.758Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:47 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-75574

Grav before 4.2.2 Remote Code Execution via Email Twig

The Grav Email plugin (getgrav/grav-plugin-email) before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publish the page, and subm…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 2561 to 2580 of 12259.First page Next page

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:26.910Z. Updated 2026-08-27T16:46:04.470Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 23:46 WIB

Official record

CritPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72702

Grav CMS before 2.0.16 Origin Validation Bypass via Referer

Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:25.032Z. Updated 2026-10-08T15:24:25.006Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

MedPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72701

Grav CMS before 2.0.16 Timing Attack via verifyNonce

Grav CMS before 2.0.16 contains a timing vulnerability in Utils::verifyNonce() that uses non-constant-time string comparison with the === operator instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonce values byte-by-byte through multiple requests, w…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:23.965Z. Updated 2026-10-08T15:24:24.438Z.

CVSS6.3v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72700

Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparison

The getgrav/grav-plugin-login Composer plugin before 3.9.1 (used by Grav) compares password reset and account activation tokens using a non-constant-time === string comparison instead of hash_equals() in classes/Controller.php (taskReset()) and login.php (activation handler). Because the token-submission endpoint (task…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:22.914Z. Updated 2026-08-25T17:25:36.693Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 00:25 WIB

Official record

CritPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72699

Grav Login Plugin before 3.9.1 Email Enumeration via Registration

The Grav Login plugin (getgrav/grav-plugin-login) before 3.9.1 is vulnerable to email address enumeration. The register() method in classes/Login.php throws a distinct exception (EMAIL_NOT_AVAILABLE) when a submitted email address already belongs to an existing account, while allowing registration to proceed otherwise.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:21.863Z. Updated 2026-08-29T11:47:42.332Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated29 Aug 2026, 18:47 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72698

Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypass

Grav CMS before 2.0.16 fails to filter system, site, and theme configuration arrays in sandboxed Twig renders, allowing content editors to read sensitive configuration values. Attackers with page-content edit access can access raw configuration arrays including secrets like cache credentials by using dot notation in Tw…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:21.127Z. Updated 2026-10-08T15:24:23.753Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72697

Grav CMS before 2.0.16 Path Traversal via media_directory

Grav CMS before 2.0.16 contains a path traversal vulnerability in the media_directory() Twig function that fails to validate filesystem paths, allowing authenticated users to enumerate and access files outside intended scope. Attackers with page authoring privileges can supply arbitrary filesystem paths to media_direct…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:18.001Z. Updated 2026-10-08T15:24:22.994Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72696

Grav CMS before 2.0.16 Symlink Following via createLockFile

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictable lock path pointing …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:14.848Z. Updated 2026-08-27T14:52:18.096Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:52 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-72695

Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the filename while preserv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:11.868Z. Updated 2026-10-08T15:24:20.325Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated08 Oct 2026, 22:24 WIB

Official record

CritPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56710

Grav Login Plugin before 1.0.16 Privilege Escalation via Unlock

Grav Login plugin versions before 1.0.16 fail to validate the target account's privilege level in the onApiUserListRowAction unlock handler. An attacker with api.users.write permission can clear login lockout counters on admin.super accounts, removing brute-force protection from the highest-privilege accounts without r…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:11.042Z. Updated 2026-08-25T15:28:35.494Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:28 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56709

Grav before 3.9.2 Host Header Injection via sendInvitationEmail

Grav before 3.9.2 fails to validate untrusted Host headers in the sendInvitationEmail() function when constructing token-bearing invitation links. Attackers can manipulate the Host header to poison invitation links and redirect users to attacker-controlled domains, bypassing the require_trusted_host protection which on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:10.057Z. Updated 2026-08-26T16:12:46.333Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:12 WIB

Official record

MedPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56708

Grav API Plugin before 1.0.16 SSRF via DNS Rebinding

Grav API plugin before 1.0.16 contains a server-side request forgery vulnerability in webhook delivery that allows attackers to bypass hostname validation by DNS rebinding. Attackers controlling authoritative DNS for a configured webhook hostname can answer validation lookups with public addresses and delivery lookups …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:08.721Z. Updated 2026-08-25T18:07:04.185Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 01:07 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56707

Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode

Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-edit access to render any registered Flex collection without permission checks. Attackers can place the shortcode in published pages to expose sensitive directory…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:06.601Z. Updated 2026-08-27T14:50:54.881Z.

CVSS8.3v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:50 WIB

Official record

MedPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56706

Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:05.474Z. Updated 2026-08-25T15:34:21.769Z.

CVSS6.1v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:34 WIB

Official record

CritPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56705

Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injection

Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:03.759Z. Updated 2026-08-25T15:29:15.538Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:29 WIB

Official record

MedPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56704

Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:02.831Z. Updated 2026-08-26T16:12:57.028Z.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 23:12 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56703

Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO

Adminer before 5.4.3 contains a remote code execution vulnerability in SQLite query handling where VACUUM INTO is not blocked despite ATTACH restrictions. Authenticated attackers can execute VACUUM INTO to write PHP code to arbitrary file paths and execute commands on the server.

Excerpt language: en.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:01.161Z. Updated 2026-08-25T18:13:21.776Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Aug 2026, 01:13 WIB

Official record

HighPublished 25 Aug 2026, 08:30 WIB

CVE-2026-56702

Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUpload

Adminer versions before 5.4.3 contain an unrestricted file upload vulnerability in the AdminerFileUpload plugin that allows authenticated users to upload PHP files by exploiting a permissive default extension allowlist. Attackers can upload PHP webshells to columns ending in _path and execute arbitrary code as the web-…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:30:00.475Z. Updated 2026-08-27T14:36:04.749Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated27 Aug 2026, 21:36 WIB

Official record

HighPublished 25 Aug 2026, 08:29 WIB

CVE-2026-34968

Adminer before 5.4.3 Arbitrary File Deletion via SQLite Drop

Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database-list drop action fails to validate file extensions before deletion. An authenticated attacker can submit arbitrary relative file paths in the db[] parameter to delete any files writable by the PHP process.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-25T01:29:59.711Z. Updated 2026-08-25T15:29:34.632Z.

CVSS7.2v4.0KEVNot listedEPSSPresentUpdated25 Aug 2026, 22:29 WIB

Official record