Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 20 KEV · 16,156 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 20
With a forecast: 16,156
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 100% · unscored 22%.

Showing 2321–2340 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

MedPublished 26 Oct 2026, 17:07 WIB

CVE-2026-115949

WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:07:24.926Z. Updated 2026-10-26T10:23:40.211Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:05 WIB

CVE-2026-115614

WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through 2.8.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 2321 to 2340 of 16156.First page Next page

Published 2026-10-26T10:05:22.425Z. Updated 2026-10-26T10:23:40.370Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:03 WIB

CVE-2026-97255

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:03:47.707Z. Updated 2026-10-26T10:23:40.524Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:02 WIB

CVE-2026-97254

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:02:36.972Z. Updated 2026-10-26T10:23:40.688Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:01 WIB

CVE-2026-97295

WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Cross Site Request Forgery.This issue affects Media LIbrary Assistant: from n/a through 3.42.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:01:28.037Z. Updated 2026-10-26T10:23:40.842Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:01 WIB

CVE-2026-112865

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:01:03.255Z. Updated 2026-10-26T10:23:41.001Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 17:00 WIB

CVE-2026-116255

PGYER codefever URI Sanitizer doc.php _detail path traversal

A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The ex…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T10:00:18.713Z. Updated 2026-10-26T10:00:18.713Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:00 WIB

Official record

MedPublished 26 Oct 2026, 16:59 WIB

CVE-2026-110377

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:59:47.003Z. Updated 2026-10-26T10:23:41.157Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 16:59 WIB

CVE-2026-115602

WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:59:24.845Z. Updated 2026-10-26T10:23:41.317Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:23 WIB

Official record

MedPublished 26 Oct 2026, 16:54 WIB

CVE-2026-115613

WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:54:36.992Z. Updated 2026-10-26T10:13:37.674Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record

MedPublished 26 Oct 2026, 16:54 WIB

CVE-2026-115958

WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:54:20.583Z. Updated 2026-10-26T10:13:37.956Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 17:13 WIB

Official record

MedPublished 26 Oct 2026, 16:47 WIB

CVE-2026-4316

Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript cod…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:47:57.353Z. Updated 2026-10-26T14:35:18.557Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:35 WIB

Official record

MedPublished 26 Oct 2026, 16:45 WIB

CVE-2026-116254

rathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation

A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is pos…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:45:18.399Z. Updated 2026-10-26T09:45:18.399Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 16:45 WIB

Official record

MedPublished 26 Oct 2026, 16:41 WIB

CVE-2026-112250

Cleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files

A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Wi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:41:29.352Z. Updated 2026-10-26T14:35:18.697Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:35 WIB

Official record

MedPublished 26 Oct 2026, 16:30 WIB

CVE-2026-116253

DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection

A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:30:05.471Z. Updated 2026-10-26T16:31:53.722Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 23:31 WIB

Official record

MedPublished 26 Oct 2026, 16:29 WIB

CVE-2026-103377

Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:29:50.749Z. Updated 2026-10-26T14:35:18.848Z.

CVSS5.1v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:35 WIB

Official record

CritPublished 26 Oct 2026, 16:15 WIB

CVE-2026-116237

Oray Pugongying X5 Pro Dnsmasq crlf injection

A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:15:17.500Z. Updated 2026-10-26T09:15:17.500Z.

CVSS9.3v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 16:15 WIB

Official record

HighPublished 26 Oct 2026, 16:00 WIB

CVE-2026-116236

Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload

A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has b…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.6 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T09:00:21.600Z. Updated 2026-10-26T09:00:21.600Z.

CVSS8.6v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 16:00 WIB

Official record

HighPublished 26 Oct 2026, 15:59 WIB

CVE-2026-82947

Multiple Out-of-Bounds Reads in Frame Processing

SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access inv…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T08:59:09.514Z. Updated 2026-10-26T08:59:09.514Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated26 Oct 2026, 15:59 WIB

Official record

MedPublished 26 Oct 2026, 15:59 WIB

CVE-2026-113438

CVE-2026-113438

Pleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid Login ID, without a password. As a result, an attacker may view, alter or delete info…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-26T08:59:05.476Z. Updated 2026-10-26T14:35:18.988Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated26 Oct 2026, 21:35 WIB

Official record