Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 12,259 published records · 20 KEV · 12,259 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

12,259 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,45512%
High4,59737%
Med3,35727%
Low3142.6%
None50.04%
Legacy00.00%
Unscored2,53121%

Matching records by UTC month

Aug 2612,259

Signal coverage

KEV-listed: 20
With a forecast: 12,259
Unknown date: 0
Unscored severity: 2,531

Share of cohort: KEV 0.16% · forecast 100% · unscored 21%.

Showing 21–40 of 12,259By severity band: Critical · 9.0–10.0 1,455, High · 7.0–8.9 4,597, Medium · 4.0–6.9 3,357, Low · 0.1–3.9 314, None · scored 0.0 5, Legacy · v2 only 0, Unscored · no CNA metric 2,531

HighPublished 01 Sep 2026, 03:53 WIB

CVE-2026-75594

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSla…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:53:00.338Z. Updated 2026-09-01T14:31:42.348Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:31 WIB

Official record

HighPublished 01 Sep 2026, 03:49 WIB

CVE-2026-61641

Wallos: OIDC account takeover via email-based account linking without `email_verified` check

Wallos is an open-source, self-hostable personal subscription tracker. From version 4.0.0 to before version 4.9.6, Wallos's OIDC login links an incoming OIDC identity to an existing local account by matching the email claim alone, without verifying that the IdP marked that email as verified (email_verified). When Wallo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 21 to 40 of 12259.First page Next page

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:49:46.759Z. Updated 2026-09-01T14:58:03.788Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

MedPublished 01 Sep 2026, 03:49 WIB

CVE-2026-75592

Kirby: Access to image files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath(). The checks accep…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:49:41.341Z. Updated 2026-09-01T13:41:40.500Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:41 WIB

Official record

HighPublished 01 Sep 2026, 03:47 WIB

CVE-2026-61640

Wallos: SSRF via OIDC Token/UserInfo URL Configuration

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, Admin-configured OIDC token_url and user_info_url in includes/oidc/handle_oidc_callback.php:18-49 are used directly in curl_init() with zero SSRF filtering. Unlike logo/webhook URLs which have validate_webhook_url_for_ssrf(),…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:47:39.969Z. Updated 2026-09-02T17:34:28.745Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:34 WIB

Official record

HighPublished 01 Sep 2026, 03:46 WIB

CVE-2026-83596

Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:46:24.116Z. Updated 2026-10-28T21:14:39.982Z.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 04:14 WIB

Official record

HighPublished 01 Sep 2026, 03:46 WIB

CVE-2026-71415

Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the acces…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:46:02.280Z. Updated 2026-09-03T18:02:09.849Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated04 Sep 2026, 01:02 WIB

Official record

MedPublished 01 Sep 2026, 03:45 WIB

CVE-2026-82914

kishan0725 Hospital-Management-System search.php sql injection

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:45:36.090Z. Updated 2026-09-01T14:38:07.126Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:38 WIB

Official record

HighPublished 01 Sep 2026, 03:44 WIB

CVE-2026-61639

Wallos: Zip Slip path traversal in database restore writes files to webroot

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/db/restore.php calls ZipArchive::extractTo() without validating entry names for ../ sequences. Admin uploads crafted zip with entry logos/../../endpoints/shell.php to write webshell to webroot. Extension filte…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:44:05.909Z. Updated 2026-09-01T14:39:58.852Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:39 WIB

Official record

CritPublished 01 Sep 2026, 03:42 WIB

CVE-2026-81779

WordPress Newspapers X theme 1.0.46-1.0.48 - Backdoor vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:42:27.262Z. Updated 2026-09-01T13:48:21.018Z.

CVSS10v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:48 WIB

Official record

HighPublished 01 Sep 2026, 03:41 WIB

CVE-2026-61638

Wallos: SSRF via Test Email Notification - unvalidated SMTP host/port

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.6, POST /endpoints/notifications/testemailnotifications.php accepts smtpaddress and smtpport from POST body with zero SSRF validation. PHPMailer connects to attacker-supplied host:port. Every other notification endpoint uses ssr…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:41:04.513Z. Updated 2026-09-01T13:50:31.633Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:50 WIB

Official record

MedPublished 01 Sep 2026, 03:40 WIB

CVE-2026-81278

WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability

Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:40:33.217Z. Updated 2026-09-01T14:58:13.959Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:38 WIB

CVE-2026-81892

EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query para…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:38:06.196Z. Updated 2026-09-03T17:59:17.173Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated04 Sep 2026, 00:59 WIB

Official record

HighPublished 01 Sep 2026, 03:35 WIB

CVE-2026-82346

HP ImageDiags - Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls.

Excerpt language: en.

Severity high: primary CNA CVSS 7 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:35:39.046Z. Updated 2026-08-31T20:53:49.878Z.

CVSS7v4.0KEVNot listedEPSSPresentUpdated01 Sep 2026, 03:53 WIB

Official record

HighPublished 01 Sep 2026, 03:33 WIB

CVE-2026-81891

elFinder: ZIP extraction bypasses uploadDeny MIME filter allowing PHP file upload (RCE)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, checkExtractItems() in php/elFinderVolumeDriver.class.php calls mimetypeInternalDetect() without passing the result through mimeTypeNormalize(). Because the .phtml, .phar, .php5, and .php3 extensions are absent from…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:33:22.283Z. Updated 2026-09-01T14:58:22.211Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:32 WIB

CVE-2026-54600

Wallos: Unauthenticated database replacement via import endpoint on fresh install

Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in versi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.2 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:32:58.226Z. Updated 2026-09-02T17:32:40.347Z.

CVSS8.2v4.0KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:32 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82229

WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:56.269Z. Updated 2026-09-01T14:40:29.193Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:40 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82228

WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:55.611Z. Updated 2026-09-01T18:08:35.434Z.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated02 Sep 2026, 01:08 WIB

Official record

CritPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82226

WordPress Tickera plugin <= 3.6.0.2 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:54.958Z. Updated 2026-09-01T13:51:19.582Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 20:51 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82225

WordPress RegistrationMagic plugin <= 6.0.9.8 - Broken Authentication vulnerability

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:54.290Z. Updated 2026-09-01T14:58:28.324Z.

CVSS7.4v3.1KEVNot listedEPSSPresentUpdated01 Sep 2026, 21:58 WIB

Official record

HighPublished 01 Sep 2026, 03:30 WIB

CVE-2026-82224

WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-31T20:30:53.635Z. Updated 2026-09-02T17:31:27.827Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated03 Sep 2026, 00:31 WIB

Official record