Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,813 published records · 14 KEV · 5,813 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,813 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit4587.9%
High1,71830%
Med2,45642%
Low2003.4%
None20.03%
Legacy00.00%
Unscored97917%

Matching records by UTC month

Apr 265,813

Signal coverage

KEV-listed: 14
With a forecast: 5,813
Unknown date: 0
Unscored severity: 979

Share of cohort: KEV 0.24% · forecast 100% · unscored 17%.

Showing 261–280 of 5,813By severity band: Critical · 9.0–10.0 458, High · 7.0–8.9 1,718, Medium · 4.0–6.9 2,456, Low · 0.1–3.9 200, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 979

HighPublished 29 Apr 2026, 18:44 WIB

CVE-2026-42248

Missing Signature Verification for Updates in Ollama

Ollama for Windows does not perform integrity or authenticity verification of downloaded update executables. Unlike other platforms, the Windows implementation of the update verification routine unconditionally returns success so no digital signature or trust validation is performed before staging or executing update p…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T11:44:33.770Z. Updated 2026-04-29T13:23:07.650Z.

CVSS7.7v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:23 WIB

Official record

MedPublished 29 Apr 2026, 18:35 WIB

CVE-2026-22745

CVE-2026-22745 : Denial of service in static resource handling on Windows platforms

Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is serving static resources from the file …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 261 to 280 of 5813.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T11:35:21.947Z. Updated 2026-04-29T13:23:54.622Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:23 WIB

Official record

LowPublished 29 Apr 2026, 18:32 WIB

CVE-2026-22741

Static resource cache poisoning in Spring MVC and WebFlux

Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources. More precisely, an application can be vulnerable when all the following are true: * the application is using Spring MVC or Spring WebFlux * the application is configuring the resource chain support https://d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity low: primary CNA CVSS 3.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T11:32:12.548Z. Updated 2026-04-29T14:01:42.273Z.

CVSS3.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:01 WIB

Official record

MedPublished 29 Apr 2026, 18:17 WIB

CVE-2026-2902

WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' function's 'WPMETEOR[N]WPMETEOR' placeholder content in all versions up to, and including, 3.4.16 due to insufficient input sanitization and output escaping. This makes it possible…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T11:17:35.637Z. Updated 2026-04-29T15:09:40.541Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 22:09 WIB

Official record

MedPublished 29 Apr 2026, 17:46 WIB

CVE-2026-22740

Spring Framework DoS with Multipart Temp Files in WebFlux

A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K. Under some circumstances, temp files may remain not deleted after the request is fully processed. This allows an attacker to consume available disk space. Older, unsupported versions are also affected.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:46:15.633Z. Updated 2026-04-29T14:00:50.573Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 21:00 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42641

WordPress Share This Image plugin <= 2.14 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: from n/a through <= 2.14.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.970Z. Updated 2026-05-12T11:03:22.047Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42645

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.11.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Cross Site Request Forgery.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.924Z. Updated 2026-05-12T11:03:21.814Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42648

WordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability

Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.22.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.921Z. Updated 2026-05-12T11:03:21.810Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42642

WordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP: from n/a through <= 4.14.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.909Z. Updated 2026-05-12T11:03:22.036Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

HighPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42646

WordPress TaxoPress plugin <= 3.44.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Burge TaxoPress simple-tags allows Blind SQL Injection.This issue affects TaxoPress: from n/a through <= 3.44.0.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.888Z. Updated 2026-05-12T11:03:22.048Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42643

WordPress Image Widget plugin <= 4.4.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP Image Widget image-widget allows Stored XSS.This issue affects Image Widget: from n/a through <= 4.4.11.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.883Z. Updated 2026-05-12T11:03:22.050Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

MedPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42644

WordPress BetterDocs plugin <= 4.3.10 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPDeveloper BetterDocs betterdocs allows Retrieve Embedded Sensitive Data.This issue affects BetterDocs: from n/a through <= 4.3.10.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.882Z. Updated 2026-05-12T11:03:21.815Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

HighPublished 29 Apr 2026, 17:40 WIB

CVE-2026-42652

WordPress User Registration plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Reflected XSS.This issue affects User Registration: from n/a through <= 5.1.5.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T10:40:45.853Z. Updated 2026-05-12T11:03:21.812Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 18:03 WIB

Official record

HighPublished 29 Apr 2026, 15:37 WIB

CVE-2026-42518

Information Disclosure Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to disclosure of sensitive information and hardcoded AES encryption keys in client-side JavaScript. An unauthenticated remote attacker could exploit this vulnerability by accessing the client-side code to extract sensitive information and cryptographic keys. Successful exploi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:37:32.944Z. Updated 2026-04-29T12:02:59.352Z.

CVSS8.7v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:02 WIB

Official record

CritPublished 29 Apr 2026, 15:37 WIB

CVE-2026-3325

SQL injection in MegaCMS by CRM Sistemas de Fidelización

SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint. The vulnerability arises from inadequate validation and sanitisation of user input. Specifically, via a POST request, the “id_territorio” parameter, used immediately after the …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 10 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:37:32.529Z. Updated 2026-04-29T12:06:07.199Z.

CVSS10v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:06 WIB

Official record

HighPublished 29 Apr 2026, 15:30 WIB

CVE-2026-42517

Cryptographic Failure Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data. An authenticated attacker could exploit this vulnerability by decoding and manipulating Base64-encoded parameters in the request URL to gain unauthorized access to sensitive information on the targeted sys…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:30:09.583Z. Updated 2026-04-29T12:14:35.241Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:14 WIB

Official record

MedPublished 29 Apr 2026, 15:27 WIB

CVE-2026-4019

Complianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint

The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due to the REST API endpoint at /wp-json/complianz/v1/consent-area/{post_id}/{block_id} using __return_true as the permission_callback, allowing any unauthenticated…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:27:43.231Z. Updated 2026-04-29T13:52:26.882Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 20:52 WIB

Official record

HighPublished 29 Apr 2026, 15:26 WIB

CVE-2026-42516

Broken Access Control Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper authorization checks during resource access. An authenticated attacker could exploit this vulnerability by manipulating encoded parameters in the request URL to gain unauthorized access to patient accounts on the targeted system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:26:15.611Z. Updated 2026-04-29T12:15:10.366Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:15 WIB

Official record

HighPublished 29 Apr 2026, 15:22 WIB

CVE-2026-42515

Insecure Direct Object Reference (IDOR) Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to improper access control in resource access validation. An authenticated attacker could exploit this vulnerability by manipulating parameter in the API request URL to gain unauthorized access to sensitive information of patients on the targeted system.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:22:57.139Z. Updated 2026-04-29T12:22:26.245Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:22 WIB

Official record

HighPublished 29 Apr 2026, 15:17 WIB

CVE-2026-42514

Sensitive Data Exposure Vulnerability in e-Sushrut HMIS

This vulnerability exists in e-Sushrut due to exposure of OTPs in plaintext within API responses. A remote attacker could exploit this vulnerability by intercepting API responses containing valid OTPs. Successful exploitation of this vulnerability could allow an attacker to impersonate the target user and gain unautho…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.8 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-04-29T08:17:12.372Z. Updated 2026-04-29T12:25:02.747Z.

CVSS8.8v4.0KEVNot listedEPSSPresentUpdated29 Apr 2026, 19:25 WIB

Official record