Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 16,156 published records · 19 KEV · 15,829 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

16,156 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit1,2247.6%
High5,34833%
Med5,51434%
Low5143.2%
None00.00%
Legacy00.00%
Unscored3,55622%

Matching records by UTC month

Oct 2616,156

Signal coverage

KEV-listed: 19
With a forecast: 15,829
Unknown date: 0
Unscored severity: 3,556

Share of cohort: KEV 0.12% · forecast 98% · unscored 22%.

Showing 341–360 of 16,156By severity band: Critical · 9.0–10.0 1,224, High · 7.0–8.9 5,348, Medium · 4.0–6.9 5,514, Low · 0.1–3.9 514, None · scored 0.0 0, Legacy · v2 only 0, Unscored · no CNA metric 3,556

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-110505

Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG files from changing a link's target to a javascript: URI, which could allow users with the author role and above to bypass its SVG sanitization and perform Stored Cross-Site Scripting attacks that exec…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:24.942Z. Updated 2026-10-29T10:56:06.878Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-110504

Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass

The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is not detected as SVG, while still storing and serving them as SVG images, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 341 to 360 of 16156.First page Next page

Published 2026-10-29T06:00:24.769Z. Updated 2026-10-29T10:56:07.031Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-110030

Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration

The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:24.596Z. Updated 2026-10-29T10:56:07.177Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-108763

Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR

The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allowing authenticated users with minimal privileges such as Sub…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:24.396Z. Updated 2026-10-29T10:56:07.338Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-108686

WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure

The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:24.208Z. Updated 2026-10-29T10:56:07.495Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-108685

WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:24.033Z. Updated 2026-10-29T10:56:07.645Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-105258

LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisit…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:23.853Z. Updated 2026-10-29T10:56:07.796Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-103693

Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:23.681Z. Updated 2026-10-29T10:56:07.950Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2024-3586

LetterPress < 2.4.0 - Admin+ Stored XSS

The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:23.500Z. Updated 2026-10-29T10:56:08.109Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-89216

vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter

The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:23.322Z. Updated 2026-10-29T10:56:08.266Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-88928

PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via Signature Verification Bypass

The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint when the request references a tokenisation operation, allowing unauthenticated attackers to overwrite the stored payment token associated with existing orders and delete saved card …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:23.147Z. Updated 2026-10-29T10:56:08.430Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-78396

Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure

The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is used to render it, allowing unauthenticated users to disclose the telephone number, e-mail address and submitter name stored with links that the settings set is configured not to d…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:22.964Z. Updated 2026-10-29T10:56:08.584Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-78395

Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass

The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end link submission, allowing unauthenticated users to submit links to a library configured to require login by reusing a form token obtained from another library that does not.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:22.791Z. Updated 2026-10-29T10:56:08.732Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-115302

Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:22.361Z. Updated 2026-10-29T10:56:08.890Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-115301

Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored form-editor content to reach that engine as executable template code, enabling an administrator to perform server-side template injection and execute arbitrary code on the server…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:22.187Z. Updated 2026-10-29T10:56:09.041Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-115300

Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only actions that bulk-delete captured form submissions and wipe a form's statistics, allowing attackers to permanently destroy a site's stored contact leads and analytics by tricking a lo…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:22.014Z. Updated 2026-10-29T10:56:09.201Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-115299

Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attacker to overwrite the site's outbound mail configuration, including the SMTP server, its credentials and the notification recipient, by tricking a logged-in administrator into visi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:21.839Z. Updated 2026-10-29T10:56:09.360Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

UnscoredPublished 29 Oct 2026, 13:00 WIB

CVE-2026-115282

Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, th…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T06:00:21.666Z. Updated 2026-10-29T10:56:09.514Z.

CVSS—KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:56 WIB

Official record

MedPublished 29 Oct 2026, 12:30 WIB

CVE-2026-93293

Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler

The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion handler in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. Once the site's Freemius opt-in is complete (the normal state after …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T05:30:31.921Z. Updated 2026-10-29T10:45:42.261Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated29 Oct 2026, 17:45 WIB

Official record

HighPublished 29 Oct 2026, 12:22 WIB

CVE-2026-118905

nvm_ls lets an untrusted version string inject sed commands, executing arbitrary commands with GNU sed

Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `nvm_ls` filters installed versions with a sed program that embeds the requested version pattern in a `\#...#` address, escaping `.` (and, since 0.40.4, `#`) but not backslash. A ver…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.1 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-10-29T05:22:35.156Z. Updated 2026-10-29T05:22:35.156Z.

CVSS7.1v4.0KEVNot listedEPSSPresentUpdated29 Oct 2026, 12:22 WIB

Official record